How foundational controls can help your organization mitigate risk and improve the reliability of its financial statements

Internal controls aren’t an all-or-nothing proposition. Just a handful of foundational controls can significantly improve an organization’s risk management and the reliability of its financial data. The difficulty lies in knowing which controls have the greatest impact — and how to strengthen them.

Learn how your organization can improve the reliability of its financial statements with the following topics:

• What are internal controls?
• Segregation of duties
• Account reconciliations
• Reporting hotlines
• Budget variance analyses

What are internal controls?

Many internal control frameworks exist that attempt to define what good internal control looks like. The most recognizable and trusted of these is the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control-Integrated Framework. It defines the underlying principles of an effective system of internal control over the following:

• Reliability of financial reporting
• Effectiveness and efficiency of operations
• Compliance with applicable laws and regulations

To do this, COSO established five integrated components, 17 principles, and 87 points of focus. The COSO framework is a comprehensive and robust resource for establishing an internal control environment that’s adaptable to various business environment, responsive to risks to the organization, and supportive of good governance. However, its complexity can limit its utility in some cases.

It’s not uncommon for small to mid-sized organizations to dismiss the COSO framework as something for large public companies. Those that attempt to implement the framework often get lost in the details and forget its purpose. However, selectively applying some of COSO’s internal controls is often beneficial for most organizations, no matter their size.

Priorities

Most organizations don’t need to implement the entire COSO framework to significantly improve their internal control environment. Prioritizing just four foundational controls can have an outsized impact on risk management:

• Segregation of duties
• Reporting hotlines
• Account reconciliations
• Budget-variance analyses

It’s usually one of these controls that either detects an internal control problem, such as fraud or a financial misstatement, or is found to be deficient when a problem occurs.

From a cost-to-benefit perspective, these controls accrue a significant risk mitigation benefit for relatively little cost. This is because they address a wide range of potential risks when compared to more transactional, process-level controls and facilitate the effective operation of other complementary controls.

Segregation of duties

Problems, such as occupational fraud, accounting errors, and financial statement manipulation have an increased potential to arise when the same individual is allowed to execute two or more conflicting activities. These types of activities drive processes with the potential to impact a company’s:

• Financial statements
• Operational performance
• Market reputation

Segregation of duties (SOD) divides these transactions between personnel to help avoid conflicts of interest. SOD is usually synonymous with IT-system access rights because most critical functions are often performed through the company’s enterprise systems.

However, it’s important to view segregation of duties from both system access and the individual roles and responsibilities. Allowing employees to be able to control two or more critical activities presents a risk to the business, and managing that risk in a pragmatic, effective way is more difficult than it may seem.

Common pitfalls

The complexity of today’s enterprise systems leaves many companies struggling with implementing and maintaining effective SOD. Below are some of the most common pitfalls experienced by IT, internal audit, and finance departments when evaluating segregation of duties.

Enterprise system security complexity

Enterprise resource planning (ERP) systems often rely on role-based security. Theoretically, this simplifies security administration, but the use of standard roles is often inappropriate for proper SOD. The risk is compounded by the fact that there’s frequently more than one way to perform a function or access data within an ERP system.

Unclear ownership

It’s often unclear who’s responsible for determining appropriate SOD. An IT department often does the technical administration, such as grant rights, remove access, and change access, but it’s the business itself that defines what’s appropriate. Because SOD requires technical and policy coordination, it can often fall through the cracks at the executive level.

Account reconciliations

Using two different sources of information to verify if figures are accurate and aligned can validate even the most complex transaction. This process, known as account reconciliation, is usually done by comparing the general ledger balance for a specific financial statement account with supporting documentation of what the balance should be.

Depending on the nature of the financial statement account being verified, the supporting documentation can include the following items:

• Reliable third-party information
• An analytically developed expectation
• A separately maintained subledger
• Another internal database

Using this data, organizations can verify and analyze the completeness, validity, valuation, calculation, and proper application of accounting principles, and other assertions around a particular transaction, helping to avoid financial misstatements and improve financial statement integrity.

Common pitfalls

Most organizations do some form of account reconciliation, but not all of them work to make their reconciliations as effective as possible. Below are some of the most common challenges faced by accounting teams.

Incomplete reconciliations

Many organizations only reconcile accounts they view as important. This approach usually misses a common error that arises when a journal entry is posted to the wrong account. Balance sheet integrity can only be achieved by reconciling every balance sheet account.

Absence of a risk-based approach

Not all reconciliations are equal. Some accounts are more complex, high volume, and prone to error while other accounts may present lower risk. Understanding the difference between high- and low-risk accounts and developing appropriate reconciliation procedures for each of them is essential for avoiding errors and maintaining efficiency in the reconciliation process.

No clear accountability

For the process to be successful, reconciliations need to be done completely, correctly, and quickly enough to catch errors before financial misstatements occur. Many organizations neglect to clarify who’s responsible for ensuring this happens. Developing a formal reconciliation calendar or checklist can help drive the process by designating who’s doing what and when they’re supposed to do it and by establishing clear quality internal control procedures.

Reporting hotlines

A 2023 National Business Ethics Survey from the Ethics & Compliance Initiative (ECI) revealed that around 53% of all employees in North America have witnessed misconduct that violates their organization’s ethics standards or the law. However, only 62% of the misconducts observed have been reported. Organizations can greatly increase the likelihood of discovering misconduct by encouraging employees to flag potential acts of impropriety through a reporting hotline.

According to the 2022 Association of Certified Fraud Examiners Report to the Nations, 42% of all frauds were detected by tips, and organizations without hotlines took an average of six months longer to detect frauds and experienced average losses that were two times higher than organizations that had hotlines.

Such hotlines are typically dedicated phone numbers, websites, or both that are administered by a third party and allow for anonymous reports. This helps prevent the fear of retaliation from stopping employees or third-party vendors from making reports.

Common pitfalls

Reporting hotlines are often viewed as a function of the HR department — a compliance box to check — which makes the control far less effective. Below are some of the most common reasons why this happens.

Lack of stakeholder buy in

If a hotline is viewed as an administrative compliance activity or worse, viewed as a nuisance or threat by senior management, it’ll never be an effective internal control — because it won’t be made a priority.

Ambiguity of appropriate use

Senior stakeholder skepticism of a reporting hotline often results in part from employees misunderstanding what the hotline is for. When employees aren’t trained on the appropriate use of a hotline and don’t understand the circumstances that would warrant a report, a hotline is often used as a mechanism to air grievances that aren’t necessarily ethical or compliance issues. According to the 2022 Report to the Nations, reports of fraud are 16% more likely to be submitted in organizations that provide hotline training.